The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request comments via the gh CLI tool in Step 8. This data is subsequently processed to answer open questions and record outcomes. An attacker could potentially embed malicious instructions within these comments that could influence the agent's behavior during the summarization or recording phase.
Ingestion points: The skill executes gh pr view <number> --comments in Step 8 to collect feedback.
Boundary markers: There are no explicit delimiters or warnings provided to the agent to distinguish between the fetched comments and its own operational instructions.
Capability inventory: The skill has the capability to write to the file system (docs/decisions/), execute shell commands (bash, rsync, cp), and run Python scripts.
Sanitization: No explicit sanitization, filtering, or escaping of the comment content is specified before it is processed by the agent.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands including rsync, cp, mkdir, and the GitHub CLI (gh). These tools are used for legitimate repository maintenance tasks such as template management and data retrieval, but they represent a broad set of capabilities that should be monitored.
[DYNAMIC_EXECUTION]: The skill generates and executes short Python scripts via python3 - using heredocs to calculate RFC numbers and handle date calculations. While these scripts are defined statically within the skill's instructions and operate on local data, this pattern involves the runtime execution of dynamically provided code.

rfc